Cicada 3301 is a name given to an organization or person that on six occasions has posted a set of puzzles and alternate reality games to possibly recruit codebreakers/linguists from the public. The first internet puzzle started on January 4, 2012, and ran for approximately one month. A second round began one year later on January 4, 2013, and a third round following the confirmation of a fresh clue posted on Twitter on January 4, 2014. The stated intent was to recruit "intelligent individuals" by presenting a series of puzzles which were to be solved. No new puzzles were published on January 4, 2015. However, on January 5th, 2016, a new clue was posted. In April 2017 another PGP signed message was found: Beware false paths. Always verify PGP signature from 7A35090F. That message explicitly denies the validity of any unsigned puzzle, as recently as April 2017. The puzzles focused a lot on data security, steganography, cyrptography. It has been called "the most elaborate and mysterious puzzle of the internet age"[11] and is listed as one of the "top 5 eeriest, unsolved mysteries of the internet" by The Washington Post and other newspapers, and much speculation exists as to its function. Many have speculated that the puzzles are a recruitment tool for the NSA, CIA, MI6, a "Masonic conspiracy" or a cyber mercenary group. Others have claimed Cicada 3301 is an alternate reality game, but the fact that no company or individual has taken credit or tried to monetize it, combined with the fact that no known individuals that solved the puzzles have ever come forward, has led most to feel that it is not.
Users browsing 4chan's /x/ board were greeted with a mysterious image, unlike much else really seen on that board. It displayed the following message in simple, white-on-black font:
and
There was almost nobody browsing /x/ at that time who did not notice it. Many initially thought it was another ARG, some thought it was an NSA recruitment program, and to this day few know where the rabbit hole leads to, and those that do have disappeared from the internet and have not told anybody else any more than they fear to let on. If it sounds like a scary story, that's because it is, yet its intrigue and mystery have captivated the minds of many. This is the mystery, and world, of Cicada 3301.
Because the message mentioned that he had a message inside, solvers were quick to try different methods to find it. The most common use was to initially open the image file into a text editing application, which allows users to read a dump of the bytes in the image. This produced the following text at the end of VS CLAVDIVS CAESAR says "lxxt> 33m2mqkyv2gsq3q = w] O2ntk" This was quickly found to be a Caesar cipher (is an algorithm for performing encryption or decryption—a series of well-defined steps that can be followed as a procedure) , hence the reference, and the deciphered text was obviously a URL, judging by the first 5 symbols is clearly a single letter followed letter, another single letter and a piece of punctuation. Decrypting this cipher, the cipher code used by Emperor Tiberius Caesar himself, led to the discovery of the following image:
This image file was a difficult clue to follow, but solvers soon realised that it meant that the program OutGuess had to be used (hence the words guess and out). In its simplest form, OutGuess is a steganography program designed to hide messages within images. Opening the image in OutGuess led to the following message: Here is a book code. To find the book, and more information, go to http://www.reddit.com/r/a2e7j6ic78h0j/. 1:20 2:3 3:5 4:20 5:5 6:53 7:1 8:8 9:2 10:4 11:8 12:4 13:13 14:4 15:8 16:4 17:5 18:14 19:7 20:31 21:12 22:36 23:2 24:3 25:5 26:65 27:5 28:1 29:2 30:18 31:32 32:10 33:3 34:25 35:10 36:7 37:20 38:10 39:32 40:4 41:40 42:11 43:9 44:13 45:6 46:3 47:5 48:43 49:17 50:13 51:4 52:2 53:18 54:4 55:6 56:4 57:24 58:64 59:5 60:37 61:60 62:12 63:6 64:8 65:5 66:18 67:45 68:10 69:2 70:17 71:9 72:20 73:2 74:34 75:13 76:21 Good luck. 3301
The original text is here, on pastebin. https://pastebin.com/aXYZzzcv
On the subreddit, these images were found, along with some posts (which were probably irrelevant):
Using Outguess, the two following texts were deciphered: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - From here on out, we will cryptographically sign all messages with this key. It is available on the mit keyservers. Key ID 7A35090F, as posted in a2e7j6ic78h0j. Patience is a virtue. Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJPBRz7AAoJEBgfAeV6NQkP1UIQALFcO8DyZkecTK5pAIcGez7k ewjGBoCfjfO2NlRROuQm5CteXiH3Te5G+5ebsdRmGWVcah8QzN4UjxpKcTQRPB9e /ehVI5BiBJq8GlOnaSRZpzsYobwKH6Jy6haAr3kPFK1lOXXyHSiNnQbydGw9BFRI fSr//DY86BUILE8sGJR6FA8Vzjiifcv6mmXkk3ICrT8z0qY7m/wFOYjgiSohvYpg x5biG6TBwxfmXQOaITdO5rO8+4mtLnP//qN7E9zjTYj4Z4gBhdf6hPSuOqjh1s+6 /C6IehRChpx8gwpdhIlNf1coz/ZiggPiqdj75Tyqg88lEr66fVVB2d7PGObSyYSp HJl8llrt8Gnk1UaZUS6/eCjnBniV/BLfZPVD2VFKH2Vvvty8sL+S8hCxsuLCjydh skpshcjMVV9xPIEYzwSEaqBq0ZMdNFEPxJzC0XISlWSfxROm85r3NYvbrx9lwVbP mUpLKFn8ZcMbf7UX18frgOtujmqqUvDQ2dQhmCUywPdtsKHFLc1xIqdrnRWUS3CD eejUzGYDB5lSflujTjLPgGvtlCBW5ap00cfIHUZPOzmJWoEzgFgdNc9iIkcUUlke e2WbYwCCuwSlLsdQRMA//PJN+a1h2ZMSzzMbZsr/YXQDUWvEaYI8MckmXEkZmDoA RL0xkbHEFVGBmoMPVzeC =fRcg -----END PGP SIGNATURE----- and -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The key has always been right in front of your eyes. This isn't the quest for the Holy Grail. Stop making it more difficult than it is. Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJPCBl3AAoJEBgfAeV6NQkPo6EQAKghp7ZKYxmsYM96iNQu5GZV fbjUHsEL164ZLctGkgZx2H1HyYFEc6FGvcfzqs43vV/IzN4mK0SMy2qFPfjuG2JJ tv3x2QfHMM3M2+dwX30bUD12UorMZNrLo8HjTpanYD9hL8WglbSIBJhnLE5CPlUS BZRSx0yh1U+wbnlTQBxQI0xLkPIz+xCMBwSKl5BaCb006z43/HJt7NwynqWXJmVV KScmkpFC3ISEBcYKhHHWv1IPQnFqMdW4dExXdRqWuwCshXpGXwDoOXfKVp5NW7Ix 9kCyfC7XC4iWXymGgd+/h4ccFFVm+WWOczOq/zeME+0vJhJqvj+fN2MZtvckpZbc CMfLjn1z4w4d7mkbEpVjgVIU8/+KClNFPSf4asqjBKdrcCEMAl80vZorElG6OVIH aLV4XwqiSu0LEF1ESCqbxkEmqp7U7CHl2VW6qv0h0Gxy+/UT0W1NoLJTzLBFiOzy QIqqpgVg0dAFs74SlIf3oUTxt6IUpQX5+uo8kszMHTJQRP7K22/A3cc/VS/2Ydg4 o6OfN54Wcq+8IMZxEx+vxtmRJCUROVpHTTQ5unmyG9zQATxn8byD9Us070FAg6/v jGjo1VVUxn6HX9HKxdx4wYGMP5grmD8k4jQdF1Z7GtbcqzDsxP65XCaOYmray1Jy FG5OlgFyOflmjBXHsNad =SqLP -----END PGP SIGNATUREhttp://net-netz-blog.de/845145127.htm
Going to this website led to an image of a cicada and a countdown. Using OutGuess on the image produced the following message:
Both of them were signed with PGP signatures. PGPs are basically a completely secure method of ensuring that the message has come from the confirmed sender. More on PGP can be found below.
In the header of the subreddit, there was the following string given: (The number sequence that is written using mayan numbers is as follows: 10 2 14 7 19 6 18 12 7 8 17 0 19 Comparing this with the a2e7j6ic78h0j7eiejd0120 in the title, we can see that numbers below 10 in the sequence above is also found in this string, at the same positions. Also note that instead of 10 we have “a”, instead of 14 we have “e”, and so on up to “j” being 19. Since the title of the page contains 23 characters and there were only 13 mayan numbers is is quite likely that we are supposed to continue converting characters from the title to numbers.)
Later was found that key was derived from King Arthur text. Translate each digit to a letter (from alphabet starting with A = 0) and you get kcohtgsmhirathosotnabca. Each letter is first letter in lines of decrypted text. This was the 'key' that Problems mentioned, being the code to the shift cipher to be applied to the lines of text in the subreddit. If this is confusing, it basically means that each letter in each string was meant to be shifted by the number corresponding to it's location in the text. This produced the following story (not complete).
The code in the original message, as mentioned to be a book code, was applied here. If you're not familiar with book codes, the first number is the line, and the second number is the character in that line. Applying the book code to the text with the full stops removed gave the following string of text: Call us at us tele phone number two one four three nine oh nine six oh eight, or 21433909608.
After calling this number this is what you would have heard (the number has since been deactivated): Very good. You have done well. There are three prime numbers associated with the original final.jpg image. 3301 is one of them. You will have to find the other two. Multiply all three of these numbers together and add a .com to find the next step. Good luck. Goodbye.
Here is a simulated recording of it.
The original image had the dimensions of 509 and 503, both of which are prime numbers. These were multiplied with 3301 to equal 845145127, which gave us http://845145127.com . Note that 845145127 is also in brackets in the GPG key's name.
As the site has now been deleted, a backup exists here: http://net-netz-blog.de/845145127.htm
Going to this website led to an image of a cicada and a countdown. Using OutGuess on the image produced the following message:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 You have done well to come this far. Patience is a virtue. Check back at 17:00 on Monday, 9 January 2012 UTC. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJPCKDUAAoJEBgfAeV6NQkPf9kP/19tbTFEy+ol/vaSJ97A549+ E713DyFAuxJMh2AY2y5ksiqDRJdACBdvVNJqlaKHKTfihiYW75VHb+RuAbMhM2nN C78eh+xd6c4UCwpQ9vSU4i1Jzn6+T74pMKkhyssaHhQWfPs8K7eKQxOJzSjpDFCS FG7oHx6doPEk/xgLaJRCt/IJjNCZ9l2kYinmOm7c0QdRqJ+VbV7Px41tP1dITQIH /+JnETExUzWbE9fMf/eJl/zACF+gYii7d9ZdU8RHGi14jA2pRjc7SQArwqJOIyKQ IFrW7zuicCYYT/GDmVSyILM03VXkNyAMBhG90edm17sxliyS0pA06MeOCjhDGUIw QzBwsSZQJUsMJcXEUOpHPWrduP/zN5qHp/uUNNGj3vxLrnB+wcjhF8ZOiDF6zk7+ ZVkdjk8dAYQr62EsEpfxMT2dv5bJ0YBaQGZHyjTEYnkiukZiDfExQZM2/uqhYOj3 yK0J+kJNt7QvZQM2enMV7jbaLTfU3VZGqJ6TSPqsfeiuGyxtlGLgJvd6kmiZkBB8 Jj0Rgx/h9Tc4m9xnVQanaPqbGQN4vZF3kOp/jAN5YjsRfCDb7iGvuEcFh4oRgpaB 3D2/+Qo9i3+CdAq1LMeM4WgCcYj2K5mtL0QhpNoeJ/s0KzwnXA+mxBKoZ0S8dUX/ ZXCkbOLoMWCUfqBn8QkQ =zn1y -----END PGP SIGNATURE-----
And so the solvers waited. After a while, the site changed.
Reapplying OutGuess on the cicada image produced a new message, containing co-ordinates, as well as two which were written on the website itself:
52.216802, 21.018334 48.85057059876962, 2.406892329454422 48.85030144151387,2.407538741827011 47.664196, -122.313301 47.637520, -122.346277 47.622993, -122.312576 37.5196666666667, 126.995 33.966808, -117.650488 29.909098706850486 -89.99312818050384 25.684702, -80.441289 21.584069, -158.104211 - -33.90281, 151.18421 36.0665472222222, -94.1726416666667 37.577070, 126.813122
This led to locations around the globe, which meant for most solvers unless you had access you all these places, you had to work together. Images of cicada were stuck to a telegraph pole, with a barcode that you could scan.
These locations were in Japan, France, Spain, Russia, Poland, South Korea, Australia, and many U.S states. This changed the game for everyone. Until now, the possibility of this being an extremely clever prank was not outruled. But now, the mastermind behind this puzzle definetely had a GLOBAL reach. Scanning the QR code led to two different images, both which being scanned using Outguess revealed two poems. Some of the telephone pole pictures are below.
Using the original Law Code (the Emperor Tiberius Code), the two passages sent solvers into a dark web .onion site. What was found there came as a surprise. 3301 had left them a message stating his disappointment of how they had worked together, instead of the one 'highly intelligent' person he had described and wanted. Most people were frustrated, having so far, and the mystery of 3301, it seemed, would never be solved.